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(54) METHOD AND SYSTEM FOR CHECKING DIGITAL SIGNATURE 



(57) In an electronic signature verification method, 
in order to perform optimum verification while coping 
with variations in signatures of an individual, data of a 
handwritten character string of a signer are fetched and 
compared with registration signature data set in 
advance; and a verification judgment is performed by 
use of separate regions including a region in which the 
signature is recognized to be true, a region in which the 
signature is not recognized to be true, and an interme- 
diate region in which re-signing is requested due to 
impossibility of judgment. The region in which the signa- 
ture is recognized to be true and the intermediate region 

fig.7 



in which re-signing is requested are determined on the 
basis of the distribution of cumulative errors between 
the registration signature data and the plurality of signa- 
ture data sets for registration, such that the region in 
which the signature is recognized to be true becomes 
wider when the distribution is wide and becomes nar- 
rower when the distribution is narrow and such that the 
intermediate region becomes wider when the distribu- 
tion is wide and becomes narrower when the distribu- 
tion is narrow. 
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Description 

TECHNICAL FIELD 

[0001 ] The present invention relates to a method of verifying an electronic signature. More particularly, the present 
invention relates to a method in which a degree of difference (cumulative error) between registered signature data and 
signature date to be verified is obtained during verification, and a signer is authenticated on the basis of the degree of 
difference, as well as to a method and apparatus for electronic-tablet correction. 

BACKGROUND ART 

[0002] A handwritten character recognition method by which written characters are recognized has been utilized as 
an input method for word processors or a signature verification method for specifying a writer. Under a handwritten 
character recognition method which has already been in actual use as an input method, characters are input under 
specified constraints on the style of typeface (e.g., in the style of Kaisho in the case of Japanese), and the thus-input 
characters are converted into coordinate information. The thus-converted coordinate information is verified by compar- 
ison with coordinate information relating to character data which have been stored beforehand. As a result of verifica- 
tion, the characters are recognized as matched. If characters are carefully written in the kaisho style at comparatively 
slow speed in the manner as previously described, the characters can be sufficiently recognized through use of only 
coordinate information because under such conditions each of the strokes of the characters becomes clear by virtue of 
visual feedback to the writer and hence the shape of the characters becomes stable. 

[0003] In contrast, in a case where the character recognition method is applied to an input method which does not 
pose any restriction on the style of typeface at the time of input of characters or to a signature verification method, there 
must be recognized not only characters written in the kaisho style but also cursively written characters. When charac- 
ters are cursively written, writing motion becomes faster and does not involve any substantial visual feedback to the 
writer. In this case, the characters become less identifiable, and separation of a resultantly acquired pattern into strokes 
becomes difficult. Further, due to a large expansion or contraction of the pattern in the direction of the time axis or in 
the direction of stroke and/or the difference between the input pattern and a pre-registered pattern in these directions, 
a matching rate is extremely low, rendering recognition of characters difficult. 

[0004] Another method is to enable recognition of characters without involving the separation of characters into 
strokes by application of time-series coordinate information and writing pressure. This method employs a pattern 
matching technique called dynamic programming (DP) matching, which takes into consideration variations in the coor- 
dinate information stemming from variations in writing action. 

[0005] In the DP matching technique, variations in the writing motion are corrected with regard to the time axis or 
the arc length axis through use of a skew function which minimizes a cumulative error between patterns to be checked. 
Patterns are matched with each other on the basis of the coordinates and writing pressure that have been corrected so 
as to compensate variations in the writing motion, thereby enabling recognition of cursively handwritten characters. 
[0006] Verification based on the addition of writing-pressure information to time-series coordinate information or 
normalization of input patterns by DP matching contributes to an improvement in the recognition rate of handwritten 
characters. However, in the case of application of the DP matching technique to recognition of cursively written charac- 
ters or signature verification, a false signature may be erroneously recognized as a genuine signature. Therefore, in its 
present form, the DP matching technique cannot be put into practical use. 

[0007] Japanese Patent No. 1,822,532 [Japanese Patent Publication (kokoku) No. 5-31798] entitled "A Method of 
Recognizing Handwritten Characters Online" describes a practical technique that is based on DP matching. Under this 
method, when the degree of difference between a registered pattern and an input pattern of handwritten characters is 
calculated by use of DP matching, time-series coordinate information and writing-pressure information are simultane- 
ously processed by the assignment of optimum weighting coefficients to the time-series coordinate information and 
writing-pressure information. As a result, the difference is reduced, which in turn contributes to an improvement in the 
verification rate of authenticity and a reduction in processing time. 

[0008] As mentioned previously, even in the case of unclear characters which cannot be separated into strokes, 
processing of the time-series coordinate information and writing-pressure information relating to handwritten characters 
enables recognition of the characters. Further, even in the case of cursively handwritten characters, the characters can 
be recognized in practice, as a result of a further improvement in the DP matching technique that compensates varia- 

tions in writing motion in order to correct cumulative errors. 

[0009] In a static signature verification system, an image scanner or an image OCR is used as a tool for reading 
characters. In contrast, in a dynamic signature verification system, a stylus pen is generally used. An appearance of 
such a dynamic signature verification system utilizing a stylus pen is shown. When characters are written on a tablet 
through use of a stylus pen, signals representing characters are sent to a verification section, where signature verrfica- 
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[tion is performed. | 

[0010] Such a tablet and stylus pen are important devices that affect easiness of use. Therefore, recently these 
devices have been improved. For example, a tablet formed from a liquid-crystal panel and a wireless stylus pen having 
no signal cable have come into use. Further, in place of a piece of hardware dedicated to signature verification, a per- 
sonal computer has come into use. In this case, signature verification is performed by software. 
[0011] The processing performed in the verification section is composed of three steps; i.e., pre-processing/nor- 
malization, character extraction, and recognition/judgment. Information from the stylus pen includes relative coordi- 
nates (x, y) relative to the start point of a signature, and writing pressure p. 

[0012] Since handwritten characters are not necessarily consistent, verification of a signature involves difficulty 
caused by variation in the direction of writing and in size, and hardware noise. The pre-processing/normalization 
removes these variations and noise and performs normalization in order to enable comparison with standard character 
patterns. Specifically, in the pre-processing, there are performed removal of excess series of points (sampling based on 
amount of relative movement), removal of random noise that depends on hand shake and resolution of a tablet 
(smoothing through load shift), removal of isolated data caused by erroneous operation of the tablet, and like opera- 
tions. After completion of such pre-processing, the size and position of input characters, are normalized. Subsequent to 
the above-described processing, characteristics of the characters are extracted, and recognition/judgment processing 

is performed. 

[0013] The above-described method for verifying electronic signatures is realistic and practical. However, such sig- 
nature verification involves many drawbacks to be solved. One of the drawbacks is that a signature is not necessarily 
consistent. 

[0014] Handwriting of a signature varies depending on the mental state of the person signing and the circum- 
stances under which the person signs. How can we authenticate a person while absorbing such variations? How can 
we avoid a possibility that a third person whose imitates the handwriting of a certain person is authenticated as the cer- 
tain person? These difficulties result in two types of errors in relation to signature verification; i.e., an error in which a 
certain person is judged to be another person (exclusion of the true person) and an error in which a person other than 
a certain person is judged to be the certain person (authentication of another person). 

[0015] In signature verification, a person inputs signature data by signing on an electronic tablet by use of an elec- 
tronic pen, which data are collated with previously registered signature data of the person by means of DP matching. 
However, since only the shape of a signature is collated in conventional signature verification schemes, characteristics 
of an electronic tablet and an electronic pen (hereinafter referred to as a "signing device") have not been taken into con- 
sideration. 

[001 6] The size, inclination, etc. , of characters are not affected by the characteristics of the signing device, because 
corresponding input signature data are normalized. However, because the handwriting of a signature is easily imitated 
in shape, signature verification on the basis of only shape is not safe. One method for solving such a problem is addition 
of writing-pressure information to shape information. Writing pressure cannot be determined from the appearance of a 
signature and depends on characteristics of a signer. Writing pressure is difficult for other persons to imitate. Thus, 
combined use of writing-pressure information and shape information enables stricter authentication of a person. 
[0017] In such case, differences in characteristics among signing devices cause a problem. Although no problem 
arises when the same signing device is used, a problem arises in the current multimedia environment in which each 
person uses a signing device of a different manufacturer. In this case, writing-pressure information varies depending on 
the type of a signing device. In an exemplary case in which a person uses a signing device A for inputting registration 
signature data serving as a reference for signature verification and uses a signing device B for inputting signature data 
to be verified, the signing devices A and B output different writing-pressure information even when the person has 
signed with the same force. Therefore, writing-pressure information — which is employed because of inherent difficulty 
in imitation by other persons — excludes a true person as well as other persons. 

[0018] An object of the present invention is to provide a method which solves the above-described problems and 
enables stable signature verification which provides a higher matching or verification rate. 

DISCLOSURE OF THE INVENTION 

[001 9] In order to solve the above-described problem, preparation of registration signature data, input of signature 
data to be verified (verification signature data), and verification taking into consideration characteristics of a signing 
device (an electronic pen or an electronic tablet) are performed in the following manner. 

[0020] That is, there is provided an electronic signature verification method in which data of a handwritten character 
string of a signer are fetched; registration signature data of the signer set in advance are retrieved; the data of the hand- 
written character string are compared with the registration signature data; and a verification judgment is performed by 
use of separate regions including a region in which the signature is recognized to be true and a region in which the sig- 
nature is not recognized to be true. When the signer sets the registration signature data, the registration signature data 
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are set, by appropriate means, from a plurality of signature data sets for registration. The region in which the signature 
is recognized to be true is determined on the basis of the distribution of cumulative errors between the registration sig- 
nature data and the plurality of signature data sets for registration, such that the region in which the signature is recog- 
nized to be true becomes wider when the distribution is wide and becomes narrower when the distribution is narrow. 
[0021 ] There is further provided an electronic signature verification method in which data of a handwritten character 
string of a signer are fetched; registration signature data of the signer set in advance are retrieved; the data of the hand- 
written character string are compared with the registration signature data; and a verification judgment is performed by 
use of separate regions including a region in which the signature is recognized to be true, a region in which the signa- 
ture is not recognized to be true, and an intermediate region in which re-signing is requested due to impossibility of 
judgment The intermediate region in which re-signing is requested is determined on the basis of the distribution of 
cumulative errors between the registration signature data and the plurality of signature data sets for registration, such 
that the intermediate region becomes wider when the distribution is wide and becomes narrower when the distribution 
is narrow. 

[0022] The above-described two methods are combined so as to provide an electronic signature verification 
method in which data of a handwritten character string of a signer are fetched; registration signature data of the signer 
set in advance are retrieved; the data of the handwritten character string are compared with the registration signature 
data; and a verification judgment is performed by use of separate regions including a region in which the signature is 
recognized to be true, a region in which the signature is not recognized to be true, and an intermediate region in which 
re-signing is requested due to impossibility of judgment, wherein the region in which the signature is recognized to be 
true and the intermediate region in which re-signing is requested are determined on the basis of the distribution of 
cumulative errors between the registration signature data and the plurality of signature data sets for registration, such 
that the region in which the signature is recognized to be true becomes wider when the distribution is wide and becomes 
narrower when the distribution is narrow and such that the intermediate region becomes wider when the distribution is 
wide and becomes narrower when the distribution is narrow. 

[0023] Further, in the above-described methods, data of a handwritten character string of a signer and signature 
data sets for registration may be corrected on the basis of correction information for each of different signing devices in 
order to absorb differences among the input devices. 

[0024] As described above, when signature data are to be registered, a person signs a plurality of times by use of 
a signing device. The thus-obtained data are fetched as time-series signature data including writing pressure informa- 
tion; characteristics which are peculiar to the signer and necessary for personal authentication are extracted in order to 
create registration signature data; and the thus-created registration signature data are registered in a master file. At this 
time, the registration signature data are collated again with a plurality of signature data sets to obtain cumulative errors 
(degree of difference). On the basis of the distribution of errors, a security level and a gray zone (intermediate region) 
corresponding to the stability of signatures of the signer are determined and registered. Further, at this time, writing- 
pressure information— which varies depends on the type of a signing device used — is converted into writing-pressure 
information of a signing device serving as a reference, in order to obtain correction information for each of different sign- 
ing devices. The thus-obtained correction information is registered. 

[0025] In the signature verification of the present invention, the sum of absolute values of differences between coor- 
dinate values contained in registration signature data and coordinate values contained in verification signature data is 
calculated and the values are averaged so as to obtain an error for each sample point. The thus-obtained error is called 
a cumulative error (degree of difference). On the basis of the degree of difference, a judgment is made as to whether a 
signature is a true signature (i.e., a signer is recognized to be a true person)) or not a true signature (i.e.. the signer is 
rejected as a person other than the true person). 

[0026] At this time, a relatively high clear line is set for a person who signs at high stability, and a relatively low clear 
line is set for a person who signs at low stability. This clear line is called a "true-person exclusion line." The lower the 
set value of the true-person exclusion line, the higher the security level that can be obtained; and the higher the set 
value of true-person exclusion line, the lower the security level that can be obtained. Data for the above-described sig- 
nature verification are stored for each person and can be retrieved at the time of verification. 

[0027] FIG. 1 is a diagram showing a cumulative-error frequency distribution and a true-person exclusion line. The 
horizontal axis of the coordinate system represents the degree of difference (cumulative error) in which the higher the 
value, the lower the probability of a signer being a true person, or the lower the value, the higher the probability of a 
signer being a true person. The origin O (0, 0) of the coordinate system is a reference point representing registration 
signature data themselves. When the degree of difference between verification signature data and registration signa- 
ture data becomes zero, the verification signature data are judged to be identical with the registration signature data. 
[0028] A curve representing the cumulative-error frequency distribution (hereinafter referred to as a "difference dis- 
tribution curve") is normalized such that the area below the curve equals 1. A point which bisects the area below the 
curve is a cerrtroid and is typically located in the vicinity of a position corresponding to the peak of the curve. When the 
area of a region on the left side of the true-person exclusion line is represented by S 1t and the area of a region (hatched 
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portion) on the right side of the true-person exclusion line is represented by S 2 , a probability r of a true person being 
excluded can be obtained as follows: 

r = S 2 /(S., + S 2 ) = S 2 , because + S 2 = 1. 

5 

[0029] That is, a true person is recognized not to be a true person at the probability r. Although the difference dis- 
tribution varies among persons, the true-person exclusion line can be drawn such that the probability r becomes con- 
stant, thereby enabling each of stable and unstable signers to be recognized as a true person at a constant probability. 
However, in a simple scheme in which a signer is recognized to be another person on the right side of the true-person 
io exclusion line and is recognized to be a true person on the left side of the true-person exclusion line, there is a high risk 
that a signature of a person having a relatively low security level is imitated by other persons. 

[0030] FIG. 2 shows a difference distribution of person A who can sign stably and a difference distribution of person 
B who cannot sign stably. In the case of this example, in order to increase the signature matching rate of person B, the 
true-person exclusion line for person B is drawn such that the area of the region on the left side of the true-person exclu- 
15 sion line becomes wider. This increases the possibility that any other person who imitates a signature of the true person 
is recognized to be the true person. Accordingly, there is a risk that other persons cannot be excluded by mere use of 
a true-person exclusion line— which is introduced in order to increase the probability of a true person being authenti- 
cated and which takes security level into consideration. 

[0031] In order to solve this problem, the present invention employs an other-person exclusion line. FIG. 3 shows 
20 the relationship between an other-person exclusion line and a true-person exclusion line. A region sandwiched between 
the two lines is called a gray zone. In FIG. 3, a region on the right side of the true-person exclusion line is called a true- 
person exclusion region. When a result of signature verification indicates that a cumulative error (degree of difference) 
falls within the true-person exclusion region, the signature is recognized to be signed by a person other than the true 
person, even if the true person has signed. 
25 [0032] Meanwhile, a region on the left side of the other-person exclusion line is called an other-person exclusion 
region, because signatures whose cumulative errors fall within this region can rarely be imitated by other persons. 
When the cumulative error falls within this region, the signer is determined to be a true person. The meaning of exclu- 
sion of other person will become clear upon reference to FIG. 4, which shows a difference distribution for the case in 
which a person other than the true person signs. In the graph of FIG. 4, although the value of frequency does not reach 
30 zero even on the left side of the other-person exclusion line, the value indicated by time-series signature data including 
writing-pressure information becomes substantially zero. 

[0033] The gray zone sandwiched between the true-person exclusion line and the other-person exclusion line is a 
vague area in which it is impossible to judge whether a true person signed or a person other than the true person 
signed. When a result of signature verification indicates that the degree of difference falls within the gray zone, re-sign- 

35 ing is requested, and signature verification is performed again for the new signature. On the basis of a result of the sig- 
nature verification, a signer is judged to be a true person or a person other than the true person. For example, when the 
result of the signature verification for the new signature indicates that the degree of difference falls within the other-per- 
son exclusion region, the signer is recognized to be the true person, and when the result indicates that the degree of 
difference falls within the true-person exclusion region, the signer is recognized to be another person. When the degree 

40 of difference again falls within the gray zone, a judgment is automatically performed again. In this case, the signer is 
preferably judged to be another person if importance is placed on strictness. 

[0034] The present invention employs a method for performing total judgment by use of a concept of security level 
and a concept of gray zone in a related manner such that the judgment for the gray zone is changed in accordance with 
the security level. This point will be described in detail in relation to an embodiment. 

45 [0035] In the above-discussion, passage or failure of a verification test (whether the signer is a true person or not) 
is determined on the basis of a region in which the degree of difference falls. However, the following point must be con- 
sidered in relation to verification signature data. Since writing-pressure information varies depending on the perform- 
ance of an electronic pen or electronic tablet used for signing, differences in input characteristics must be corrected in 
the case in which verification signature data include not only shape but also writing pressure, as in the present inven- 

50 tion. 

[0036] In general, as shown in FIG. 5, a proportional relationship exists between actual writing pressure and meas- 
ured writing pressure as read from an electronic pen or electronic tablet. When electronic tablets or pens A, B, and C 
output measured writing pressures p A , Pb> and pc, respectively, for actual writing pressures p, correction values a A , ob. 
and oq for the measured writing pressures p A , p B , and p c with respect to a measured writing pressure p N from a refer- 
55 ence electronic tablet or pen N are represented as follows: 

<x A «p A /p N 



5 



EP 1 028 391 A1 



«b = Pb / Pn 
a c =Pc / Pn 

[0037] When the relationship between actual writing pressure and measured writing pressures can be approxi- 
mated by use of straight lines as shown in FIQ. 5 and the lines pass through the origin O, the correction value a is con- 
stant regardless of the value of p. Therefore, measured writing pressure can be corrected by use of a correction value 
obtained from the above expressions. That is, when a writing pressure Ps which is applied on an electronic pen or tablet 
S at a certain time and which is represented by verification signature data is represented as follows: 

Ps = (x st , y s|1 P St ), 

a corrected writing pressure Ps' is represented as follows: 

Ps , = (x st ,y st .p st -a 8 ). 

[0038] Accordingly, when corrected verification signature data Ps' are compared with corrected registration signa- 
ture data, verification can be performed without regard to the type of an electronic tablet or pen to be used. In the fol- 
lowing description, unless otherwise specified, the term "writing pressure** means measured writing pressure (writing- 
pressure information). Although correction is performed for measured writing pressure output from an electronic tablet 
or an electronic pen, in the following description such correction will be simply referred to as "tablet correction." 
[0039] The above<Jescribed tablet correction assumes that the relationship between actual writing pressure and 
measured writing pressure can be approximated by use of a straight line. However, when a tablet whose characteristics 
cannot be approximated by use of a straight line is used, a curved-line approximation or a correction table may be used. 
However, the basic concept is the same as in the case of straight-line approximation. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0040] 

FIG. 1 is a graph used for description of a cumulative error frequency distribution (difference distribution) and a 
true-person exclusion line in the Means to Solve the Problems section; 

FIG. 2 is a graph used for description of a relationship between stability in signing and a true-person exclusion line 
in the Means to Solve the Problems section; 

FIG. 3 is a graph used for description of a relationship between a true-person exclusion line and an other-person 
exclusion line, as well as a gray zone, in the Means to Solve the Problems section; 

FIG. 4 is a graph used for description of the merit of presence of a true-person exclusion line in the Means to Solve 
the Problems section; 

FIG. 5 is a graph used for description of tablet correction in the Means to Solve the Problems section; 

FIG. 6 shows an exemplary structure of hardware used in an embodiment of the present invention; 

FIG. 7 is a graph used for description of a method for determining a rank in accordance with security level in the 

embodiment of the invention; 

FIG. 8 is a diagram used for description of a method for separating characters on the basis of writing-pressure infor- 
mation in the embodiment of the invention; 

FIG. 9 is a graph related to the embodiment of the invention and used for description of a relationship between the 
number of times of signing and a probability at which the degree of difference successively falls within the gray 
zone; 

FIG. 10 is a flowchart showing signature verification processing performed in the embodiment of the invention; 
FIG. 1 1 is a graph related to the embodiment of the invention and used for description of a relationship between the 
number of times of signing and a probability at which the degree of difference successively falls within the gray 
zone, for the case in which a person other than a true person imitates the signature of the true person; 
FIG. 12 is a diagram related to the embodiment of the invention and schematically showing an example of a system 
configuration used for verifying the owner of a credit card through signature verification; 

FIG. 13 is a graph related to the embodiment of the invention and used for description of a method of treating the 
gray zone; and 

FIG. 14 is a flowchart showing signature verification processing in the embodiment of the invention. 
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BEST MODE FOR CARRYING OUT THE INVENTION 

[0041 ] Handwritten character recognition according to the present invention involves acquisition of coordinate infor- 
mation and writing-pressure information relating to characters to be verified; and arithmetic processing of these sets of 
information. To this end, there are needed means for measuring the coordinate information and writing-pressure infor- 
mation relating to handwritten characters, and arithmetic processing means for processing the thus-obtained sample 
data. The coordinate information and writing-pressure information measured by sampling the written characters at pre- 
set time intervals take the form of three-dimensional time-series data. However, these sets of information are preferably 
represented as data series comprising complex coordinate series and writing pressure series. The means for measur- 
ing the coordinate information and writing-pressure information comprises, e.g., a stylus pen having a built-in pressure 

sensor, and a digitizer for detecting the coordinates of the tip end of the pen. 

[0042] With regard to the characters used as the standards for verification and characters to be collated, data are 
obtained by means of sampling coordinate information and writing speed information at equal time intervals. The thus- 
obtained data are normalized to correspond to an equal number of sampling points and are further preliminarily normal- 
ized with regard to position and size. For example, in the case of lateral writing action, in many cases a pen is moved 
from left to right. Such constant motion may hinder verification of the characters. For this reason, it is desirable to cal- 
culate a uniform stroke component from the pattern and to subtract the thus-obtained uniform stroke component from 

the coordinate information normalized with regard to position and size. 

[0043] In the present invention, setting of registration signature data is performed as follows. Writing-pressure infor- 
mation is obtained from an electronic tablet of a pressure-sensing type and is registered in a server (see FIG. 6) con- 
nected to a terminal via a communication line. Signature verification is performed in the server, and one or more 
correction values for respective tablets are measured in advance and registered in a master file in the form of a constant 
value (in the case of a single constant correction value being used) or in the form of a table (in the case of different cor- 
rection values being used). 

[0044] When registration signature data are set, a person who wishes to resister his signature signs a plurality of 
times in order to create registration signature data. 
[0045] Subsequently, there are performed the steps of: 

(1) averaging the plurality of signature data sets for registration in order to calculate a candidate set of registration 
signature data; 

(2) collating the candidate set of registration signature data with each signature data set for registration; 

(3) when no unacceptable discrepancy is found as a result of verification between the candidate set of registration 
signature data and the signature data sets for registration, treating the candidate set of registration signature data 
as registration signature data; and 

(4) when at least one unacceptable discrepancy is found as the result of verification between the candidate set of 
registration signature data and the signature data sets for registration, repeating steps (1) and (2) in order to find a 
candidate set of registration signature data for which no unacceptable discrepancy is found as a result of verifica- 
tion with the signature data sets for registration, and treating the candidate set of registration signature data as reg- 
istration signature data. 

[0046] Instead of the above-described method in which data creation is repeated until a desired result is obtained, 
there can be employed a method comprising the steps of: 

(1) averaging a plurality of signature data sets in order to calculate a candidate set of registration signature data; 

(2) collating the candidate set of registration signature data with each signature data set for registration; 

(3) when no unacceptable discrepancy is found as a result of verification between the candidate set of registration 
signature data and the signature data sets for registration, treating the candidate set of registration signature data 
as registration signature data; and 

(4) when at least one unacceptable discrepancy is found as a result of verification between the candidate set of reg- 
istration signature data and the signature data sets for registration, inputting an additional signature data set for 
registration; forming a plurality of groups each consisting of signature data sets for registration selected from the 
increased number of signature data sets for registration such that the number of signature data sets for registration 
in each group is less than the total number of signature data sets for registration; collating with each signature data 
set for registration a candidate set of registration signature data that is obtained by averaging the signature data 
sets in each group; and treating, as registration signature data, the candidate set of registration signature data of 
the group that produces the best verification result. 



[0047] The registration signature data may be registered as they are or may be registered together with the type of 
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tablet used. In the former case, signature data are corrected by use of a correction value determined with respect to a 
reference tablet, and the thus-corrected data are registered as the registration signature data. Therefore, correction of 
the registration signature data during verification processing is not required. In the latter case, during the verification 
processing, the registration signature data are corrected by use of a correction value corresponding to the type of the 
tablet. The former case is generally used for registration. 

[0048] At the same time, a difference distribution (cumulative error distribution) is measured, and a true-person 
exclusion line and an other-person exclusion line are determined and registered. Further, as shown in FIG. 7, one of 
three security levels L A , L^, and Lq is set in accordance with the value of the true-person exclusion line. Signatures of 
a person whose true-person exclusion line falls within the level L A are judged to be highly stable and are categorized in 
rank A; signatures of a person whose true-person exclusion line falls within the level Lb are categorized in rank B; and 
signatures of a person whose true-person exclusion line falls within the level Lc are categorized in rank C. This opera- 
tion is called ranking on the basis of security level. 

[0049] Next, signature verification will be described. The signature verification is performed on the basis of a cumu- 
lative error between the verification signature data and the registration signature data. Calculation for the signature ver- 
ification is performed in the following manner. 

[0050] Cumulative error D (sum of normalized degrees of difference (in the present invention, simply called "degree 
of difference")) is calculated by use of the following Equations 1 and 2. Equation 1 represents the degree of difference 
between the m-th character of registration signature data A and the corresponding character of verification signature 
data set B. 

Le(m) 

£ «1- <"p> • I z*aW-z* bM*»I 2 + W P • \p\W~p* 0<t(*))I 2 ) 

^ 

[0051] Equation 2 represents the overall degree of difference of the signature; i.e., a normalized degree of differ- 
ence obtained through a calculation in which the sum of the degrees of difference for the respective characters is 
divided by the total number of data points in the characters. 



M 

£d 5 (m)-(Le(mKs(m) + 1) 
£(/_e(m)-Ls(m)+1) 



D(A 9 B) = *" 1 mm Eq. 2 



where L^m), Le(m) respectively represent the start and end points of the m-th character, M represents the number of 
characters, w p represents a weighting coefficient, x(k) represents a skew function at the k-th sample point of the m-th 
character, and z* and p* respectively represent normalized positional coordinates and a normalized writing pressure 
coordinate. The coefficient w p satisfies the following relation: 

0 £ w p £ 1. 

Through adjustment of this coefficient, the effect of writing-pressure information on authentication judgment is varied. 
[0052] Further, z* represents the following complex coordinates: 

z* = x* + iy* 

i = SQRT(-1) (the square root of -1). 

[0053] The skew function x is a function for minimizing the cumulative error of handwritten signature data. The posi- 
tional coordinates and writing pressure coordinate of the signature data B corrected by use of this function are z* B (x(k)) 
and p*B(t(k)). In other words, the cumulative error can be minimized through selection of a coordinate point {(z* B Mk)), 
P*e( T ( k )) °f tn e signature data B that corresponds to a coordinate point {(z* A (t(k)), p* A (T(k)) of the signature data A. 
Each of the writing-pressure information p* A ( T ( k ) and the writing-pressure information p*B( x ( k )) used here is a value 
subjected to tablet correction. 

[0054] The number of characters can be obtained from the writing-pressure information, an example of which is 
shown in FIG. 8. As shown in FIG. 8, characters are separated from one another while a portion where the writing pres- 
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sure P becomes zero is used as a separation point. However, when the distance between adjacent strokes (e.g., sec- 
ond and third strokes of the second character) is less than a predetermined value, the two strokes are regarded as 
belonging to a single character. The start and end points of each section obtained through separation of characters are 
Lq and Le, respectively, and coordinates (including the pressure component) are provided for each section. 

5 [0055] Next, the method for signature verification will be described. In the following description, as shown in FIG. 9, 
the degree of difference of an other-person exclusion line is represented by D 1 ; the degree of difference of a true-person 
exclusion line is represented by D 2 ; the degree of difference of verification signature data is represented by D; and 
security level is divided into level L A or rank A, level I_b or rank B, and level Lq or rank C (see FIG. 7). Basically, regard- 
less of security level, judgment is performed as follows. 

io [0056] When D < D-j , a signer is recognized as a true person (passes a verification test). 
[0057] When D > D 2 . a signer is recognized as another person (fails the verification test). 

[0058] The above judgment is natural from the viewpoint of the purpose of the other -person exclusion line and the 
true-person exclusion line. However, signatures falling in the gray zone are treated in one of different manners in 
accordance with situation and purpose. For example, the gray zone has different meanings for persons having different 

is security levels. That is, in the case of a person having a high security level (a person in rank A in the above-described 
definition), since the gray zone itself is present in a region which is hardly invaded or the person's signature is less likely 
to be imitated, the gray zone itself can be regarded a true-person recognition region. By contrast in the case of a person 
having a low security level (a person in rank C in the above-described definition), the gray zone is a region which the 
person's signature is easily imitated, and is therefore regarded an other-person recognition region in situations which 

20 require strictness. 

[0059] In view of the above, re-signing is requested when D is not less than D 1 and not greater than D 2 , and verifi- 
cation is performed again for a newly input signature. In this verification, judgment is made in the following manner, 
depending on the security rank (i.e.. rank A, B, or C). When the degree of difference of the newly input signature is rep- 
resented by D, judgment is performed as follows, regardless of security level. 
25 [0060] When D < D 1 ( a signer is recognized as a true person (passes a verification test). 
[0061 ] When D > D 2 , a signer is recognized as another person (fails the verification test). 

[0062] However, when £ D <> D 2 ; i.e., when D falls within the gray zone, different judgment criteria are set for a 
person whose security level is rank A, a person whose security level is rank B, and a person whose security level is rank 

C. 

30 

(1) For a person whose security level is rank A: 

if £ D £ D 2 , the person is recognized as a true person. 

35 (2) For a person whose security level is rank B: 

if D 1 £ D £ D 1 -KD 2 -D 1 )/2 , the person is recognized as a true person; and if not, the system entrusts an 
operator to make judgment as to, for example, whether re-signing must be requested. 

40 (3) For a person whose security level is rank C: 

the system always entrusts an operator to make judgment as to, for example, whether re-signing must be 
requested. 

45 [0063] In the above-described example, an ambiguous expression "entrusting an operator" is used. However, such 
operation may be performed mechanically such that when a value of D falls within the gray zone, the signer is repeat- 
edly requested to sign; and when the value of D enters either the true-person exclusion region (in which the signer is 
determined to be another person) or the other-person exclusion region (in which the signer is determined to be a true 
person), a judgment is made as to whether the signer is the true person or a person other than the true person. 

so [0064] That is, mechanical judgment can be performed by means of a judgment method shown in the flowchart of 
FIG. 10. It is assumed that ranks have been determined at the time of creation of registration signature data (but may 
be modified later). The flowchart shows processing which embodies the above-described method. The processing will 
be described in a summarized manner. 

55 • For a person whose security level is rank A (a highly stable signer), the gray zone is regarded an other-person 
exclusion region (in which the signer is determined to be a true person) to thereby lower the pass level of the veri- 
fication test. 

For a person whose security level is rank B (an intermediately stable signer), the value of the other-person exclu- 
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sion line is increased to D ,+{D 2 -D ^)IZ to thereby increase matching rate. However, the signer is requested to re- 
sign repeatedly until the inequality D < D-i or D > D 2 is attained. 

For a person whose security level is rank C (unstable signer), the signer is requested to re-sign repeatedly until the 
inequality D < or D > D 2 is attained. 

[0065] The reason why the signer is requested to re-sign repeatedly so long as the value of D falls within the gray 
zone will be described. As shown in FIG. 9, it is assumed that the area of an other-person exclusion region is S n ; the 
area of a gray zone is S g ; the area of a true-person exclusion region is S2; and S 1t S g , and S 2 are normalized such that 
S n +S g +S 2 = 1 . In this case, the area S n (n=1, g, 2) represents the probability of the degree of difference D of verifi- 
cation signature data falling within the corresponding region. 

[0066] Accordingly, when the gray zone is determined to account for 40% regardless of security level, the probabil- 
ity S g m at which all of m sets of verification signature data fall within the gray zone is 0.4 m . Therefore, when m=4, S g m 
becomes 0.0256, which means that only two of about 100 signatures fall within the gray zone. However, since the other- 
person exclusion region (in Which the signer is determined to be a true person) for each of ranks A and B is widened, 
the matching rate increases considerably as compared with the case in which judgment is simply made by D < D 1 . 
Since the gray zone is widened, the person whose security level is rank C (unstable signer) may be requested to re-sign 
repeatedly. However, this is important from the viewpoint of necessity of excluding other persons. 
[0067] As shown in FIG. 1 1 , a signature of a person imitating a signature of an unstable signature falls within the 
gray zone for the unstable signature at a high probability. When the probability (area) of such an imitated signature fall- 
ing within the gray zone is represented by S g \ the probability of two imitated signatures falling within the gray zone is 
represented by S g ' 2 . When S g = 0.05 (=5%), the probability of two imitated signatures falling within the gray zone is 
0.0025, or two signatures among about 1000 signatures. The probability decreases exponentially as the re-signing is 
repeated. When the present invention utilizing time-series data including writing -pressure information is employed, it 
becomes considerably difficult for other persons to imitate a registered signature such that an imitated signature is 
judged to match the registered signature at a probability of 5%. Further, since the probability decreases exponentially 
as the re-signing is repeated, the possibility at which a person other than a true person is recognized to be the true per- 
son is almost zero. This demonstrates the importance of the gray zone. 

[0068] The manner of treating the gray zone is not limited to the above-described manner, and may be modified in 
accordance with a field in which signature verification is used and the purpose of signature verification. Such an exam- 
ple will be described as an embodiment of the present invention. 

[0069] In an example serving as the embodiment of the present invention, signature verification is performed when 
a customer shops by credit card at a store which accepts credit cards. Registration signature data are registered in a 
server at the company which has issued the credit card. An electronic tablet of a pressure-sensing type is provided in 
the store. Signature data are converted into verification signature data at a terminal and are sent to the server via a 
communication tine. FIG. 12 shows the configuration of the system. Different stores may use different types of elec- 
tronic tablets. However, it is assumed that correction values for different tablets have already been measured and stored 
in a master file of the server. 

[0070] When a customer pays for goods or services by used of a credit card, the terminal reads card information 
from the card. Subsequently, the terminal is connected to the server of the credit company which manages the card, 
and the server issues a request for an electronic signature. In accordance with the request, the customer signs. Signa- 
ture data are sent, as verification signature data, to the server and verified therein, and a result of verification is reported 
to the terminal. On the basis of the verification result, a clerk judges whether the customer can use the card. 
[0071] When the verification result indicates that the degree of difference D falls within the other-person exclusion 
region, the customer is recognized as a true person, and the credit card transaction is permitted. When the verification 
result indicates that the degree of difference D falls within the true-person exclusion region, the customer is recognized 
as another person, and the credit card transaction is denied. When the degree of difference D falls within the gray zone, 
re-signing is requested. When a signature produced as a result of the re-signing is again judged such that its degree of 
difference falls within the gray zone, re-signing is requested again. When a signature produced as a result of the second 
re-signing is again judged such that its degree of difference falls within the gray zone, the clerk determines whether the 
credit card transaction is to be accepted or denied. As described above, the probability of an imitated signature falling 
within the gray zone decreases exponentially through repeated re-signing. Taking this into consideration, the other-per- 
son exclusion region is widened as the number of times of re-signing increases, in order to increase matching rate with 
respect to the true person while excluding other persons. That is, as shown in FIG. 13, the gray zone is equally divided 
into three zones, and the other -person exclusion line used tor judgment is shifted rightward by d each time re-signing 
is performed. 

[0072] FIG. 14 shows a flowchart of the above-described processing. The processing of FIG. 14 is basically the 
same as that of FIG. 10 except that ranks of security level are not used; the gray zone is divided into three zones in 
order to increase matching rate every time re-signing is performed; and the final judgment is entrusted to the clerk. The 
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reason why the final judgment is made by the clerk is as follows. In the case of a stable signer, the probability of passing 
a verification test in an early stage is high. By contrast, in the case of an unstable signer, his signatures may involve 
variation greater than that represented by an actual error distribution (difference distribution registered at the begin- 
ning). In this case, the probability of the true person being recognized not to be the true person becomes higher than 
5 the probability of another person successively imitating the signature in order to illegally use the card. In such case, 
when the card holder is a regular customer and is familiar to the clerk, or when the card holder can be proven to be a 
true person by means of his ID card or the like, the customer is judged to be the true owner of the card. This procedure 
is practical for stores. 

[0073] In the method used in the present embodiment, security level is taken into consideration only in determining 
w the true-person exclusion line. Therefore, if the gray zone is set to account for the same ratio for a person having a low 
security level (unstable signer) and for a person having a high security level (stable signer), the degree of difference falls 
within the gray zone at the same rate regardless of the type of person who signed. This causes a greater problem in 
relation to true-person exclusion than in relation to other-person exclusion. Accordingly, the manner of judgment may 
need to be changed in accordance with the type of signer, through the above-described methods, such as a method in 
75 which ranking is performed according to security level and a method in which, for a stable signer the other-person exclu- 
sion line is shifted toward the true-person exclusion line in order to narrow the gray zone to thereby widen the true-per- 
son recognition region. 

[0074] Since the gray zone employed in the present invention is considered to be a fuzzy portion, the gray zone may 
vary depending on the field in which signature verification is used and the purpose of signature verification. For exam- 

20 pie, when signature verification is used to control entry into a laboratory having a high level of confidentiality, judgment 
is preferably performed mechanically as in the example mentioned in the embodiment. By contrast, when a credit card 
is used at a store having a clerk who can personally identify customers in many cases, there is needed a method in 
which mechanical or automatic judgment is combined with judgment by a human. Especially, in the latter case, provi- 
sion of a gray zone—which is a fuzzy portion — enables creation of a state in which judgment by a human is performed 

25 with ease. However, in this case, it is naturally required that there be devised a method of setting a gray zone, as well 
as a processing method, in order to reduce situations in which judgment must be made by a human. 

INDUSTRIAL APPLICABILITY 

30 [0075] In a conventional signature verification technique, judgment as to whether a signer is a true person or not 
has been performed on the basis of the absolute value of a cumulative error (a cumulative error value which is constant 
regardless of the stability of signatures). Such a conventional method involves a problem in that a person who cannot 
sign stably (an unstable signer) is not recognized to be a true person. When an attempt is made to increase the overall 
matching rate, a line which is set for a person who can sign stably (a stable signer) and which prevents other persons 

35 from imitating the signature lowers, causing a security problem. The concept of security level of the present invention 
has solved these two conflicting problems. That is, the present invention employs a true-person exclusion line which 
changes depending on security level. Since the true-person exclusion line — which is a pass line (a border line (true-per- 
son exclusion line) used for recognition of a true person) — is determined in accordance with the security level or the sta- 
bility of a signer, matching rate does not depend on the stability of the signer. 

40 [0076] However, since the true-person exclusion line for a person having a lower security level (an unstable signer) 
is set so as to increase the matching rate, it becomes difficult to exclude other persons. In order to solve this problem, 
the present invention employs the concept of combined use of an other-person exclusion line and a gray zone. The 
introduction of a gray zone, in which judgment as to whether a signer is a true person or not cannot be performed, ena- 
bles achievement of two conflicting improvements; i.e., an increase in other-person exclusion rate and an increase in 

45 true-person recognition rate. 

[0077] The conventional signature verification is performed on the basis of shape only. Therefore, the type of an 
electronic pen or tablet used for signing has not be taken into consideration. By contrast, in the present invention, writ- 
ing-pressure information is added to factors of signature verification. This writing-pressure information prevents a per- 
son other than a true person from imitating a signature of the true person, because writing pressure is information which 

so cannot be obtained through observation of a signature, although the shape of the signature can be obtained visually. 
The tablet correction according to the present invention is used to correct the writing-pressure information and enables 
use of the signature verification method of the present invention regardless of the type of electronic pen or tablet to be 
used. Accordingly, a user can use a type that the user has grown accustomed to or an inexpensive type. Although the 
term "tablet correction" is used in the description, it means "correction of writing-pressure information" and encom- 

55 passes correction for writing-pressure information from an electronic pen and correction for writing-pressure informa- 
tion from an electronic tablet. 
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1 . An electronic signature verification method in which data of a handwritten character string of a signer are fetched; 
registration signature data of the signer set in advance are retrieved; the data of the handwritten character string 
are compared with the registration signature data; and a verification judgment is performed by use of separate 
regions including a region in which the signature is recognized to be true and a region in which the signature is not 
recognized to be true, characterized in that 

(1) when the signer sets the registration signature data, the registration signature data are set, by appropriate 
means, from a plurality of signature data sets for registration; and 

(2) the region in which the signature is recognized to be true is determined on the basis of the distribution of 
cumulative errors between the registration signature data and the plurality of signature data sets for registra- 
tion, such that the region in which the signature is recognized to be true becomes wider when the distribution 
is wide and becomes narrower when the distribution is narrow. 



2. An electronic signature verification method in which data of a handwritten character string of a signer are fetched; 
registration signature data of the signer set in advance are retrieved; the data of the handwritten character string 
are compared with the registration signature data: and a verification judgment is performed by use of separate 
regions including a region in which the signature is recognized to be true, a region in which the signature is not rec- 
ognized to be true, and an intermediate region in which re-signing is requested due to impossibility of judgment, 
characterized in that 

(1) when the signer sets the registration signature data in advance, the registration signature data are set, by 
appropriate means, from a plurality of signature data sets for registration; and 

(2) the intermediate region in which re-signing is requested is determined on the basis of the distribution of 
cumulative errors between the registration signature data and the plurality of signature data sets for registra- 
tion, such that the intermediate region becomes wider when the distribution is wide and becomes narrower 
when the distribution is narrow. 

3. An electronic signature verification method in which data of a handwritten character string of a signer are fetched; 
registration signature data of the signer set in advance are retrieved; the data of the handwritten character string 
are compared with the registration signature data; and a verification judgment is performed by use of separate 
regions including a region in which the signature is recognized to be true, a region in which the signature is not rec- 
ognized to be true, and an intermediate region in which re-signing is requested due to impossibility of judgment, 
characterized in that 

(1) when the signer sets the registration signature data in advance, the registration signature data are set, by 
appropriate means, from a plurality of signature data sets for registration; and 

(2) the region in which the signature is recognized to be true and the intermediate region in which re-signing is 
requested are determined on the basis of the distribution of cumulative errors between the registration signa- 
ture data and the plurality of signature data sets for registration, such that the region in which the signature is 
recognized to be true becomes wider when the distribution is wide and becomes narrower when the distribu- 
tion is narrow and such that the intermediate region becomes wider when the distribution is wide and becomes 
narrower when the distribution is narrow. 

4. An electronic signature verification system in which data of a handwritten character string of a signer are fetched; 
registration signature data of the signer set in advance are retrieved; the data of the handwritten character string 
are compared with the registration signature data; and a verification judgment is performed by use of separate 
regions including a region in which the signature is recognized to be true and a region in which the signature is not 
recognized to be true, characterized in that 

(1) when the signer sets the registration signature data, the registration signature data are set, by appropriate 
means, from a plurality of signature data sets for registration; and 

(2) the region in which the signature is recognized to be true is determined on the basis of the distribution of 
cumulative errors between the registration signature data and the plurality of signature data sets tor registra- 
tion, such that the region in which the signature is recognized to be true becomes wider when the distribution 
is wide and becomes narrower when the distribution is narrow. 
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An electronic signature verification system in which data of a handwritten character string of a signer are fetched; 
registration signature data of the signer set in advance are retrieved; the data of the handwritten character string 
are compared with the registration signature data; and a verification judgment is performed by use of separate 
regions including a region in which the signature is recognized to be true, a region in which the signature is not rec- 
ognized to be true, and an intermediate region in which re-signing is requested due to impossibility of judgment, 
characterized in that 

(1) when the signer sets the registration signature data in advance, the registration signature data are set, by 
appropriate means, from a plurality of signature data sets for registration; and 
io (2) the intermediate region in which re-signing is requested is determined on the basis of the distribution of 

cumulative errors between the registration signature data and the plurality of signature data sets for registra- 
tion, such that the intermediate region becomes wider when the distribution is wide and becomes narrower 
when the distribution is narrow. 

An electronic signature verification system in which data of a handwritten character string of a signer are fetched; 
registration signature data of the signer set in advance are retrieved; the data of the handwritten character string 
are compared with the registration signature data; and a verification judgment is performed by use of separate 
regions including a region in which the signature is recognized to be true, a region in which the signature is not rec- 
ognized to be true, and an intermediate region in which re-signing is requested due to impossibility of judgment, 
characterized in that 

(1) when the signer sets the registration signature data in advance, the registration signature data are set, by 
appropriate means, from a plurality of signature data sets for registration; and 

(2) the region in which the signature is recognized to be true and the intermediate region in which re-signing is 
requested are determined on the basis of the distribution of cumulative errors between the registration signa- 
ture data and the plurality of signature data sets for registration, such that the region in which the signature is 
recognized to be true becomes wider when the distribution is wide and becomes narrower when the distribu- 
tion is narrow and such that the intermediate region becomes wider when the distribution is wide and becomes 
narrower when the distribution is narrow. 

A recording medium for a computer which stores a program for performing an electronic signature verification 
method in which data of a handwritten character string of a signer are fetched; registration signature data of the 
signer set in advance are retrieved; the data of the handwritten character string are compared with the registration 
signature data; and a verification judgment is performed by use of separate regions including a region in which the 
signature is recognized to be true and a region in which the signature is not recognized to be true, characterized in 
that 

(1) when the signer sets the registration signature data, the registration signature data are set, by appropriate 
means, from a plurality of signature data sets for registration; and 
40 (2) the region in which the signature is recognized to be true is determined on the basis of the distribution of 

cumulative errors between the registration signature data and the plurality of signature data sets for registra- 
tion, such that the region in which the signature is recognized to be true becomes wider when the distribution 
is wide and becomes narrower when the distribution is narrow. 

A recording medium for a computer which stores a program for performing an electronic signature verification 
method in which data of a handwritten character string of a signer are fetched; registration signature data of the 
signer set in advance are retrieved; the data of the handwritten character string are compared with the registration 
signature data; and a verification judgment is performed by use of separate regions including a region in which the 
signature is recognized to be true, a region in which the signature is not recognized to be true, and an intermediate 
region in which re-signing is requested due to impossibility of judgment, characterized in that 

(1) when the signer sets the registration signature data in advance, the registration signature data are set, by 
appropriate means, from a plurality of signature data sets for registration; and 

(2) the intermediate region in which re-signing is requested is determined on the basis of the distribution of 
55 cumulative errors between the registration signature data and the plurality of signature data sets for registra- 
tion, such that the intermediate region becomes wider when the distribution is wide and becomes narrower 
when the distribution is narrow. 
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9. A recording medium for a computer which stores a program for performing an electronic signature verification 
method in which data of a handwritten character string of a signer are fetched; registration signature data of the 
signer set in advance are retrieved; the data of the handwritten character string are compared with the registration 
signature data; and a verification judgment is performed by use of separate regions including a region in which the 
signature is recognized to be true, a region in which the signature is not recognized to be true, and an intermediate 
region in which re-signing is requested due to impossibility of judgment, characterized in that 

(1) when the signer sets the registration signature data in advance, the registration signature data are set, by 
appropriate means, from a plurality of signature data sets for registration; and 

(2) the region in which the signature is recognized to be true and the intermediate region in which re-signing is 
requested are determined on the basis of the distribution of cumulative errors between the registration signa- 
ture data and the plurality of signature data sets for registration, such that the region in which the signature is 
recognized to be true becomes wider when the distribution is wide and becomes narrower when the distribu- 
tion is narrow and such that the intermediate region becomes wider when the distribution is wide and becomes 
narrower when the distribution is narrow. 

1 0. An electronic signature verification method according to any one of claims 1 -3. wherein data of a handwritten char- 
acter string of a signer and signature data sets for registration are corrected on the basis of correction information 
for each of different signing devices. 

1 1 . An electronic signature verification system according to any one of claims 4-6, wherein data of a handwritten char- 
acter string of a signer and signature data sets for registration are corrected on the basis of correction information 
for each of different signing devices. 

12. A recording medium for a computer according to any one of claims 7-9, wherein data of a handwritten character 
string of a signer and signature data sets for registration are corrected on the basis of correction information for 
each of different signing devices. 
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